Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects
Bernhard R. Link wrote: > Attached patch fixes the problem for me. The problem seems to be that > FFBSaveScreen uses GET_FFB_FROM_SCREEN, which is #defined as > ((FFBPtr)(s)->devPrivates[CreatorScreenPrivateIndex].ptr) > but CreatorScreenPrivateIndex and devPrivates seem to be only set in > ffb_accel, not by ffb_driver. When initializing the server that due to > some strange reason causes no problem[1], but when the last client exists > and the server is doing a reset, CreatorScreenPrivateIndex is 5 here > and points to strange values (0 or 0x1 and stuff like that) thus > causing an segfault. > > Hochachtungsvoll, > Bernhard R. Link > > [1] On some other cards there might be no accelerator without additional > stuff, thus already segfaulting when starting the X server here. That > might exlain why it sometimes may already segfault when starting the > server and why that segfault at the start no longer happens with some > firmware package. > Added to the upstream bug, thanks a lot! Brice -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects
Attached patch fixes the problem for me. The problem seems to be that
FFBSaveScreen uses GET_FFB_FROM_SCREEN, which is #defined as
((FFBPtr)(s)->devPrivates[CreatorScreenPrivateIndex].ptr)
but CreatorScreenPrivateIndex and devPrivates seem to be only set in
ffb_accel, not by ffb_driver. When initializing the server that due to
some strange reason causes no problem[1], but when the last client exists
and the server is doing a reset, CreatorScreenPrivateIndex is 5 here
and points to strange values (0 or 0x1 and stuff like that) thus
causing an segfault.
Hochachtungsvoll,
Bernhard R. Link
[1] On some other cards there might be no accelerator without additional
stuff, thus already segfaulting when starting the X server here. That
might exlain why it sometimes may already segfault when starting the
server and why that segfault at the start no longer happens with some
firmware package.
diff -u xserver-xorg-video-sunffb/src/ffb_driver.c xserver-xorg-video-sunffb-1.1.0/src/ffb_driver.c
--- xserver-xorg-video-sunffb/src/ffb_driver.c 2008-03-16 17:00:18.0 +0100
+++ xserver-xorg-video-sunffb-1.1.0/src/ffb_driver.c 2008-03-16 17:30:40.0 +0100
@@ -1010,7 +1010,12 @@
done in "ffb_dac.c" `for aesthetic reasons.'
*/
{
-return FFBDacSaveScreen(GET_FFB_FROM_SCREEN(pScreen), mode);
+ScrnInfoPtr pScrn;
+FFBPtr pFfb;
+
+pScrn = xf86Screens[pScreen->myNum];
+
+return FFBDacSaveScreen(GET_FFB_FROM_SCRN(pScrn), mode);
}
static void
Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects
* Brice Goglin <[EMAIL PROTECTED]> [080216 21:24]: > Do you have afbinit installed? According to Adam Cécile (from bug > #463794), we should add something like the following to the sunffb > README.Debian: > > "Sun Elite3D card series needs a firmware to be loaded to work properly. > A Debian package named afbinit is available and will care about loading > and initializing all Elite cards present on your system. However it > depends on a non-free microcode that should be fetched manually from the > Sun website. Please read the README.Debian of the afbinit package > carefully for more informations." No, I have no afbinit installed. I also think this is a Creator 3D and not an Elite 3D (it's prom name "SUNW,ffb", it's model name "SUNW,501-3129" and the board_type 001b). And as the download step in /usr/share/doc/afbinit/README.Debian does not work I also cannot test it with afbinit. What is "work properly" supposed to mean? The server starts, it shows an rxvt I'm opening and the text I enter (well there is a keyboard problem, but that should be unrelated and I will report separately) and thus works without afbinit, except segfaulting when all client disconnect: This I must add, which I overlooked first: It does not segfault when the first client disconnects, but when the last connected clients disconnects (which also means if the first client disconnects before an second client connected). Hochachtungsvoll, Bernhard R. Link -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects
Bernhard R. Link wrote: > When trying to downgrade the X related packages to testing, I still > see this problem. (Or a similar one, at least it segfaults). > I'm thus adding the testing version to the found list. > Do you have afbinit installed? According to Adam Cécile (from bug #463794), we should add something like the following to the sunffb README.Debian: "Sun Elite3D card series needs a firmware to be loaded to work properly. A Debian package named afbinit is available and will care about loading and initializing all Elite cards present on your system. However it depends on a non-free microcode that should be fetched manually from the Sun website. Please read the README.Debian of the afbinit package carefully for more informations." Brice
Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects
package xserver-xorg-video-sunffb found 455313 1:1.1.0-2 thanks * Brice Goglin <[EMAIL PROTECTED]> [071214 22:22]: > Bernhard R. Link wrote: > > When I running an X server using xserver-xorg-video-sunffb directly > > from the command line (don't have anything installed currently and > > only had an xserver installed to have xrandr 1.2 to test), the xserver > > crashes when the first client disconnects. > > Following a (slightly shortened) script of a gdb run. (sunffb has no -dbg > > package, perhaps I'll find the time to recompile it with debugging symbols > > later): > > > > It would be very nice to build this debugging package (see [1] for help). > Your analysis looks good to me, but I'd like to get a full debugging > backtrace before reporting the problem upstream. | Script started on Sat Dec 22 14:54:55 2007 | :~# gdb --args /usr/bin/Xorg :9 | (gdb) r | Starting program: /usr/bin/Xorg :9 | [Thread debugging using libthread_db enabled] | | X.Org X Server 1.4.0 | Release Date: 5 September 2007 | X Protocol Version 11, Revision 0 | Build Operating System: Linux Debian (xorg-server 2:1.4.1~git20071119-1) | Current Operating System: Linux nn122 2.6.22-3-sparc64-smp #1 SMP Mon Nov 12 12:48:41 UTC 2007 sparc64 | Build Date: 02 December 2007 02:40:49AM | | Before reporting problems, check http://wiki.x.org | to make sure that you have the latest version. | Module Loader present | Markers: (--) probed, (**) from config file, (==) default setting, | (++) from command line, (!!) notice, (II) informational, | (WW) warning, (EE) error, (NI) not implemented, (??) unknown. | (==) Log file: "/var/log/Xorg.9.log", Time: Sat Dec 22 14:55:00 2007 | (==) Using config file: "/etc/X11/xorg.conf" | [New Thread 0xf7fce6b0 (LWP 10150)] | [tcsetpgrp failed in terminal_inferior: Operation not permitted] | (II) Module "ddc" already built-in | (II) Module "ramdac" already built-in | Detected FFB1-SpeedSort, Z-buffer, Double-buffered. | expected keysym, got XF86KbdLightOnOff: line 70 of pc | expected keysym, got XF86KbdBrightnessDown: line 71 of pc | expected keysym, got XF86KbdBrightnessUp: line 72 of pc | The XKEYBOARD keymap compiler (xkbcomp) reports: | > Error:No Symbols named "sun5" in the include file "sun_vndr/us" | > Exiting | > Abandoning symbols file "default" | Errors from xkbcomp are not fatal to the X server | Could not init font path element unix/:7100, removing from list! | Could not init font path element /usr/share/fonts/X11/cyrillic, removing from list! | Could not init font path element /usr/share/fonts/X11/100dpi/:unscaled, removing from list! | Could not init font path element /usr/share/fonts/X11/75dpi/:unscaled, removing from list! | Could not init font path element /usr/share/fonts/X11/Type1, removing from list! | Could not init font path element /usr/share/fonts/X11/100dpi, removing from list! | Could not init font path element /usr/share/fonts/X11/75dpi, removing from list! | Could not init font path element /var/lib/defoma/x-ttcidfont-conf.d/dirs/TrueType, removing from list! | | FreeFontPath: FPE "/usr/share/fonts/X11/misc" refcount is 2, should be 1; fixing. | Detected FFB1-SpeedSort, Z-buffer, Double-buffered. Here again connecting and disconnecting a client to the server... | | Program received signal SIGSEGV, Segmentation fault. | [Switching to Thread 0xf7fce6b0 (LWP 10150)] | 0xf78c94b4 in FFBDacSaveScreen (pFfb=0xf7d3b928, mode=0) | at ../../src/ffb_dac.c:535 | 535 tmp = DACCFG_READ(dac, FFBDAC_CFG_TGEN); /* Get the timing information */ | (gdb) bt full | #0 0xf78c94b4 in FFBDacSaveScreen (pFfb=0xf7d3b928, mode=0) | at ../../src/ffb_dac.c:535 | tmp = 8192 | dac = (ffb_dacPtr) 0x0 | #1 0xf78cc58c in FFBSaveScreen (pScreen=0x291ca8, mode=0) | at ../../src/ffb_driver.c:1013 | No locals. | #2 0xf78cba4c in FFBScreenInit (scrnIndex=0, pScreen=0x291ca8, argc=2, | argv=0xffe59db4) at ../../src/ffb_driver.c:719 | pScrn = (ScrnInfoPtr) 0x1fb718 | pFfb = (FFBPtr) 0x1fc790 | ret = 1874096 | afb_fem = 655488 | visual = (VisualPtr) 0x1b96b4 | #3 0x0003c098 in AddScreen (pfnInit=0xf78cb4a0 , argc=2, | argv=0xffe59db4) at ../../dix/main.c:769 | i = 0 | scanlinepad = | format = | depth = | bitsPerPixel = 32 | k = | pScreen = (ScreenPtr) 0x291ca8 | #4 0x000732a8 in InitOutput (pScreenInfo=0x1eb050, argc=2, argv=0xffe59db4) | at ../../../../hw/xfree86/common/xf86Init.c:850 | i = 0 | j = | k = | scr_index = 2011216 | modulelist = | optionlist = (pointer *) 0xffe597e8 | layout = (screenLayoutPtr) 0x1c9800 | screenpix24 = | pix24 = | pix24From = | autoconfig = 1873920 | generation = 2 | #5 0x0003c960 in main (argc=2, argv=0xffe59db4, envp=0x1) | at ../../dix/main.c:369 | i = | error = -134346768 | al
Processed: Re: Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects
Processing commands for [EMAIL PROTECTED]: > package xserver-xorg-video-sunffb Ignoring bugs not assigned to: xserver-xorg-video-sunffb > found 455313 1:1.1.0-2 Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects Bug marked as found in version 1:1.1.0-2. > thanks Stopping processing here. Please contact me if you need assistance. Debian bug tracking system administrator (administrator, Debian Bugs database) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects
Bernhard R. Link wrote: > When I running an X server using xserver-xorg-video-sunffb directly > from the command line (don't have anything installed currently and > only had an xserver installed to have xrandr 1.2 to test), the xserver > crashes when the first client disconnects. > Following a (slightly shortened) script of a gdb run. (sunffb has no -dbg > package, perhaps I'll find the time to recompile it with debugging symbols > later): > It would be very nice to build this debugging package (see [1] for help). Your analysis looks good to me, but I'd like to get a full debugging backtrace before reporting the problem upstream. Also, this problem did not occur with xserver-xorg-core and xserver-xorg-video-sunffb from testing, right? Thanks, Brice [1] http://wiki.debian.org/HowToGetABacktrace -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#455313: xserver-xorg-video-sunffb: crashes when client disconnects
Package: xserver-xorg-video-sunffb
Version: 1:1.1.0-3
Severity: normal
When I running an X server using xserver-xorg-video-sunffb directly
from the command line (don't have anything installed currently and
only had an xserver installed to have xrandr 1.2 to test), the xserver
crashes when the first client disconnects.
Following a (slightly shortened) script of a gdb run. (sunffb has no -dbg
package, perhaps I'll find the time to recompile it with debugging symbols
later):
| gdb --args /usr/bin/Xorg :9
| This GDB was configured as "sparc-linux-gnu"...
| (gdb) r
| Starting program: /usr/bin/Xorg :9
| [Thread debugging using libthread_db enabled]
|
| X.Org X Server 1.4.0
| Release Date: 5 September 2007
| X Protocol Version 11, Revision 0
| Build Operating System: Linux Debian (xorg-server 2:1.4.1~git20071119-1)
| Current Operating System: Linux nn122 2.6.22-3-sparc64-smp #1 SMP Mon Nov 12
12:48:41 UTC 2007 sparc64
| Build Date: 02 December 2007 02:40:49AM
|
| Before reporting problems, check http://wiki.x.org
| to make sure that you have the latest version.
| Module Loader present
| Markers: (--) probed, (**) from config file, (==) default setting,
| (++) from command line, (!!) notice, (II) informational,
| (WW) warning, (EE) error, (NI) not implemented, (??) unknown.
| (==) Log file: "/var/log/Xorg.9.log", Time: Sun Dec 9 18:16:54 2007
| (==) Using config file: "/etc/X11/xorg.conf"
| [New Thread 0xf7fca6b0 (LWP 20089)]
| [tcsetpgrp failed in terminal_inferior: Operation not permitted]
| (II) Module "ramdac" already built-in
| Detected FFB1-SpeedSort, Z-buffer, Double-buffered.
| expected keysym, got XF86KbdLightOnOff: line 70 of pc
| expected keysym, got XF86KbdBrightnessDown: line 71 of pc
| expected keysym, got XF86KbdBrightnessUp: line 72 of pc
| expected keysym, got XF86KbdLightOnOff: line 70 of pc
| expected keysym, got XF86KbdBrightnessDown: line 71 of pc
| expected keysym, got XF86KbdBrightnessUp: line 72 of pc
| FreeFontPath: FPE "/usr/share/fonts/X11/misc" refcount is 2, should be 1;
fixing.
| Detected FFB1-SpeedSort, Z-buffer, Double-buffered.
|
| Program received signal SIGSEGV, Segmentation fault.
| [Switching to Thread 0xf7fca6b0 (LWP 20089)]
| 0xf7931a98 in FFBDacSaveScreen ()
|from /usr/lib/xorg/modules/drivers//sunffb_drv.so
| (gdb) bt
| #0 0xf7931a98 in FFBDacSaveScreen ()
|from /usr/lib/xorg/modules/drivers//sunffb_drv.so
| #1 0xf7932cf4 in ?? () from /usr/lib/xorg/modules/drivers//sunffb_drv.so
| #2 0xf7932cf4 in ?? () from /usr/lib/xorg/modules/drivers//sunffb_drv.so
| Backtrace stopped: previous frame identical to this frame (corrupt stack?)
| (gdb) disassemble
| Dump of assembler code for function FFBDacSaveScreen:
| 0xf7931a7c : save %sp, -112, %sp
| 0xf7931a80 : cmp %i0, 0
| 0xf7931a84 : be 0xf7931ab8
| 0xf7931a88 : sethi %hi(0x1000), %g1
| 0xf7931a8c : or %g1, 0x2cc, %g1 ! 0x12cc
| 0xf7931a90 : sethi %hi(0x6000), %g2
| 0xf7931a94 : ld [ %i0 + %g1 ], %o0
| 0xf7931a98 : st %g2, [ %o0 ]
| 0xf7931a9c : ld [ %o0 + 4 ], %g1
| 0xf7931aa0 : cmp %i1, 2
| 0xf7931aa4 : ble 0xf7931ac0
| 0xf7931aa8 : cmp %i1, 1
| 0xf7931aac : cmp %i1, 3
For comparison, the begin of FFBDacSaveScreen:
! Bool
! FFBDacSaveScreen(FFBPtr pFfb, int mode) {
! int tmp;
! ffb_dacPtr dac;
! if(!pFfb) return FALSE; /* Is there any way at all this could happen? */
! else dac = pFfb -> dac;
!
! tmp = DACCFG_READ(dac, FFBDAC_CFG_TGEN); /* Get the timing information */
!
! switch(mode) {
and from the header file:
| #define DACCFG_READ(DAC, ADDR) ((DAC)->cfg = (ADDR), (DAC)->cfgdata)
So this looks like the write to pFfb -> dac -> cfg is failing. Looking at the
registers, it looks like pFfb -> dac is NULL:
| End of assembler dump.
| (gdb) info registers
| g0 0x00
| g1 0x12cc 4812
| g2 0x6000 24576
| g3 0xf7949e4c -141255092
| g4 0x1ff088 2093192
| g5 0x20287769 539522921
| g6 0x21f958 2226520
| g7 0xf7fca6b0 -134437200
| o0 0x00
| o1 0x11
| o2 0xf7939000 -141324288
| o3 0xff807b0c -8357108
| o4 0xff807b0c -8357108
| o5 0x116c 4460
| sp 0xff807a50 0xff807a50
| o7 0xf79329c0 -141350464
| l0 0xf7fc6000 -134455296
| l1 0xbc18000 197230592
| l2 0x00
| l3 0x00
| l4 0x00
| l5 0x00
| l6 0x00
| l7 0xf7949660 -141257120
| i0 0xf7d37920 -137135840
| i1 0x00
| i2 0x1f4cd0 2051280
| i3 0x44
| i4 0xf7c526e8 -138074392
| i5 0x1ff088 2093192
| fp 0xff807ac0 0xff807ac0
| i7 0xf7932cec -141349652
| y
